AI Agents Expose Long-Standing OAuth Token Security Gaps in Enterprise Tools

·1 views

Recent breaches at Vercel and Composio involved no phishing — attackers simply stole pre-approved OAuth tokens, bypassing users entirely. OAuth token abuse has been a known vulnerability in platforms like Google Workspace and Microsoft 365 for years, but AI agents have widened the risk by acting autonomously with overly broad, long-lived permissions. Unlike compromised passwords, stolen tokens can grant access across multiple connected services simultaneously, increasing the potential damage. The core challenge for security teams is that AI agents lack human behavioral patterns, making existing anomaly-detection tools unreliable for spotting misuse. Experts urge developers to treat OAuth scope selection as a security decision and call on security teams to audit agent identities and enforce least-privilege access more rigorously.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Yield on Cost: The Dividend Metric That Matters More Than Current Yield

While current yield — annual dividend divided by today's price — is the most commonly cited dividend metric, investors who reinvest dividends should focus instead on yield on cost, which measures annual dividend income against the original amount invested. An open-source JavaScript library called dividend-math includes a DRIP calculator that simulates dividend reinvestment year by year, accounting for share accumulation, price growth, and dividend growth. Over a 15–20 year horizon, the combination of rising dividends and reinvested shares can push yield on cost to two or three times the starting yield, even if current yield appears flat. This happens because the denominator in yield on cost is fixed at historical cost, while both dividend income and share count continue to grow. The library is MIT-licensed, available on npm, and powers several pages on dividendpayoutcalculator.com, with all formulas covered by unit tests to avoid calculation errors.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why HEIC Files Silently Break Browser Image Tools and How to Fix It

HEIC, the default photo format on iPhones, uses HEVC encoding that is patent-encumbered, meaning Chrome, Firefox, and Edge cannot decode it — only Safari can, since Apple licenses HEVC platform-wide. This creates a hidden bug where browser-based image tools fail silently with no error or preview when a HEIC file is uploaded. Common workarounds like renaming the file extension do not help, as decoders check the file's actual bytes rather than its name. Developers are also warned that iOS files frequently arrive with an empty file.type value, causing validation logic to incorrectly reject valid photos. The recommended fix involves detecting HEIC via its binary header and lazy-loading a WebAssembly-based decoder like heic2any only when needed, avoiding unnecessary bundle bloat for the majority of users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Admits His 'Fully Verified' App Generator Skips Testing Its Own Parser

A developer built a tool called appgen that converts a plain-English sentence into a running, dependency-free Python application without using a language model, completing the process in roughly 2 milliseconds. The tool's README claimed 100% verification across 810 domain-feature-family test cells, but the developer later acknowledged this figure is misleading. The 810-cell sweep tests only the code-generation components downstream of user input, entirely bypassing the hand-written keyword parser that processes the original sentence. The developer did conduct a separate experiment to evaluate the parser as an intent classifier, but noted that fair measurement was difficult since he authored the test phrases himself. The post serves as a candid self-correction, distinguishing between what the verification actually covers and what a typical reader would assume it covers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Should unsigned web requests be treated as suspicious? Experts debate the tradeoff

As request-signing standards emerge for automated internet traffic, developers are debating how to handle unsigned requests. One perspective argues that an unsigned request carries no claim at all — it has not lied — and that most legitimate internet traffic remains unsigned. The concern is that penalizing unsigned traffic could stall adoption by creating a chicken-and-egg problem where no one signs because there is no benefit, and there is no benefit because no one signs. A proposed middle ground suggests rewarding verified, signed traffic with faster access and higher limits rather than punishing the absence of a signature. The debate remains open, with some acknowledging that a purely reward-based approach may be too slow to drive meaningful adoption of new signing standards.

0 comments Read more at DEV Community